3 ms·

I wonder if the xkcd comic about this is still accurate, being that it's generally safer to have longer passwords regardless of how it's formatted. https://xkc

I wonder if the xkcd comic about this is still accurate, being that it's generally safer to have longer passwords regardless of how it's formatted. https://xkcd.com/936/ https://xkcd.com/936/ I recently signed up for a ticketing website to buy tickets for a concert and was appalled that the site wouldn't accept my 50+ character generated password... I had to enter something between 8 and 15 characters. Still seems to me that "^Zh7*2wNfRG7ehj" would still be inherently less secure than "thisisasuperlongpasswordandithas12345alotofcharactersinitthatwouldtake12345rainbowtablesalongtimetocalculatefor" 15 vs 111 characters to find permutations for. That is, of course, even assuming that the password db for the site is even hashed (AND salted) or not.

Blikkentrekker 5y ago
> I wonder if the xkcd comic about this is still accurate, being that it's generally safer to have longer passwords regardless of how it's formatted. Indeed, that is what I am wondering. If the double length offsets that it is not random. Twice the length is quite a lot, but it's also not random any more.
- mafuy 5y ago
  The comic is still accurate and always will be. It's just a mathematical law, even though it uses a popular display of it. What you are wondering about is the size of base of the exponentiation. Let's look into that. If you use individual, unrelated letters, this is 26 (or 52 when you allow uppercase, or 62 if you also allow numbers). At e.g. 12 letter, this is 62 to the power of 12. At 16 letters, it is 62 to the 16. If you use words (as the comic proposes), then the dictionary size will be the base (in this case, 4000 or so). You have fewer words, so entropy is 4000 to the 4. If you use phonologically grouped words or syllables, the base size is their number. I'm not a linguist, but I'd guess it is somewhere around 100 or so. If a syllable is 2 to 3 letters long and you use 32 letters, you get something like 12 syllables. Entropy is 100 to the 12.

Blikkentrekker 5y ago

> I wonder if the xkcd comic about this is still accurate, being that it's generally safer to have longer passwords regardless of how it's formatted. Indeed, that is what I am wondering. If the double length offsets that it is not random. Twice the length is quite a lot, but it's also not random any more.

mafuy 5y ago
The comic is still accurate and always will be. It's just a mathematical law, even though it uses a popular display of it. What you are wondering about is the size of base of the exponentiation. Let's look into that. If you use individual, unrelated letters, this is 26 (or 52 when you allow uppercase, or 62 if you also allow numbers). At e.g. 12 letter, this is 62 to the power of 12. At 16 letters, it is 62 to the 16. If you use words (as the comic proposes), then the dictionary size will be the base (in this case, 4000 or so). You have fewer words, so entropy is 4000 to the 4. If you use phonologically grouped words or syllables, the base size is their number. I'm not a linguist, but I'd guess it is somewhere around 100 or so. If a syllable is 2 to 3 letters long and you use 32 letters, you get something like 12 syllables. Entropy is 100 to the 12.